dmenu

commit 7c0334de3dd84a3c40ee5bdfb5a8e547445e25c9
parent 8627d0c659f5bb79ba29edd0e7264fb7549e6fac
Author: Hiltjo Posthuma <hiltjo@codemadness.org>
Date:   Tue, 27 Oct 2026 21:09:38 +0100

check integer overflow for multiplication before realloc

Diffstat:
M
dmenu.c
 | 
3
+++

1 file changed, 3 insertions(+), 0 deletions(-)
diff --git a/dmenu.c b/dmenu.c
@@ -1,6 +1,7 @@
 /* See LICENSE file for copyright and license details. */
 #include <ctype.h>
 #include <locale.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -556,6 +557,8 @@ readstdin(void)
 	for (i = 0; (len = getline(&line, &linesiz, stdin)) != -1; i++) {
 		if (i + 1 >= itemsiz) {
 			itemsiz += 256;
+			if (itemsiz > SIZE_MAX / sizeof(*items))
+				die("too many items");
 			if (!(items = realloc(items, itemsiz * sizeof(*items))))
 				die("cannot realloc %zu bytes:", itemsiz * sizeof(*items));
 		}